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Abstract. We address the security of continuous-variable quantum key distribution with 
squeezed states upon realistic conditions of noisy and lossy environment and limited 
reconciliation efficiency. Considering the generalized preparation scheme and clearly 
distinguishing between classical and quantum resources, we investigate the effect of finite 
squeezing on the tolerance of the protocol to untrusted channel noise. For a long-distance 
strongly attenuating channel and the consequent low reconciliation efficiency, we show 
that feasible limited squeezing is surprisingly sufficient to provide the security of Gaussian 
quantum key distribution in the presence of untrusted noise. We explain the effect by behaviour 
of the Holevo quantity, which describes the information leakage, and is effectively minimized 
by the squeezed states. 
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1. Introduction 

Quantum key distribution (QKD) HI 13 is well known to be the main practical application of 
the fundamental principles of quantum physics on the single quanta level and is the core part 
of quantum information processing. It has its goal in establishing communication channels, 
where physical principles guarantee the security of cryptographic keys. First proposed for the 
single quanta (qubits), it was lately developed on the basis of continuous variables (CV) [J3J , 
which are observables of either coherent BS [H [6l 13 or squeezed (8l HI OH [EH [T2J states of 
light. Due to use of quadrature modulation and homodyne measurement the latter approach 
does not need single-photon sources and detectors. In a typical CV QKD scenario, one of the 
trusted parties (Alice) performs displacement of a carrier state by modulating it in one or both 
of complementary quadratures. States are sent thought the channel, that is assumed to be fully 
under the control of a potential eavesdropper (Eve) and are then detected by the remote trusted 
party (Bob), which randomly measures one of the quadratures using a homodyne detector 
(or simultaneously both quadratures using a pair of the homodyne detectors in the balanced 
heterodyne scenario lfT3l[T4l ). After transmitting a sufficient number of bits, parties exchange 
classical information and apply classical algorithms to perform reconciliation, which includes 
discretization of Gaussian data and error correction and results in identical bit strings, from 
which the secure key is distilled using classical privacy amplification algorithms. 

The unconditional security of the CV QKD protocols was proven for the general case of 
collective attacks [fT51 [T6l (which implies security against the most general coherent attacks 
ifTTl ) using extremality of Gaussian states [fT8l as such that provide maximum information to 
an eavesdropper. The lower bound on the unconditionally secure key rate in a generic direct 
and reverse reconciliation (DR and RR respectively) Gaussian CV QKD protocol has the form 
0UH1: 

Idr = @Iab — Xae, Irr = @Iab — Xbe (1) 

where Iab is the mutual information between trusted parties, Holevo quantity xae (Xbe) 
is the upper bound on information, which can be available to an eavesdropper under the 
collective attacks scenario, and j3 is the reconciliation efficiency, which characterizes, how 
effectively trusted parties process the data. The security of a scheme is established as the 
positivity of the lower bound (OQ) in either reconciliation scenario. 

The successful experimental demonstrations of the CV QKD were performed lfT9ll2Tll22l 
l23l . but two serious limitations were revealed. First, the DR scenario was remarkably shown 
to be unable to provide security under channel losses higher than —3dB flU (the limitation, 
which can be overcome by the use of either post-selection [22J or the RR scheme [SI). On 
the other hand, existing reconciliation algorithms suffer from low efficiency (the effect, also 
known in the discrete-variable QKD fl24l|). especially under RR and high level of loss lfT9ll . 
To overcome this limitation, the discrete modulation of coherent states [|25l l26l l27l l28l |29l 
can be used. Alternatively, it might be expected, that squeezing can qualitatively help when 
the reconciliation efficiency is limited and thus lowers I AB . Since the analysis of DR and RR 
squeezed state protocol upon limited (5 has not been carried out in jH HI [TOl [EH CGI [121 and 
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Figure 1. a) Continuous-variable quantum key distribution scheme: Alice generates squeezed 
signal states with squeezed variance V and applies independent and generally different 
amplitude and phase quadrature displacement to encode each next bit using amplitude and 
phase quadrature modulators (AM and PM). The signal travels through an untrusted lossy 
and noisy channel and is measured by Bob using two homodyne detectors, for T = 1 the 
measurement is homodyne, and for T = 1/2 it is heterodyne, b) Equivalent general source 
model based on the coupling of two oppositely-squeezed beams with different squeezing 
parameters and heterodyne measurement at the Alice side, fed by a squeezed state. 



squeezing was not distinguished from high modulation, it is not clear how much we gain from 
the feasible amount of squeezing. 

In this paper, we predict that feasible limited squeezing is sufficient to reach evident 
tolerance to the channel noise for the long-distance quantum channels when the signal- 
to-noise ratio and, accordingly, reconciliation efficiency are low. To prove it, we have 
modified the entanglement-based scheme 113011 to be able to distinguish between the resources 
by independently varying squeezing and displacement in the state preparation. Thus we 
compare squeezed-state and coherent- state Gaussian protocols with optimal displacement 
under conditions of the same low reconciliation efficiency. We show the linear improvement 
of the security region by squeezing, which results in the fact that even limited squeezing 
can provide robustness to noise about an order of magnitude higher than is tolerable by 
coherent states. The result principally opens an experimentally feasible Gaussian-modulation 
alternative to the discrete modulation protocols, recently proposed for the same purpose of 
overcoming limited reconciliation. 

2. Modified entanglement-based scheme 

We verify the security of squeezed and coherent states in the conditions of an untrusted 
channel with transmittance rj and excess noise e. Since we estimate the maximum 
performance of a state in the Gaussian CV QKD, we assume that the state preparation is 
noiseless. At the same time we follow the pessimistic scenario and consider all the noise, 
observed by the remote party, as untrusted (it can be both channel and untrusted detector 
noise). 
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We consider the displacement and measurement of quadrature observables of a light 
mode, which can be introduced as linear combination of anihilation and creation operators of 
the given mode as x = a) + a and p = i(a) — a). Under such a definition the quadrature 
fluctuations of a vacuum or coherent state mode will be equal to 1, which we refer to as the 
shot-noise unit (SNU). 

To access both displacement and squeezing independently in the conditions of noisy 
channel we perform calculations modeling the general prepare-and-measure scheme (see 
figured] (a)) by the equivalent entanglement-based (EPR) scheme (figure [H(b)) representing 
a slightly modified version of the original scheme from 11301 . In this scheme the source is 
constructed by coupling two differently oppositely squeezed modes, while the measurement of 
Alice is carried out as heterodyne with the second input of the beam splitter fed by a squeezed 
vacuum with the squeezing direction being the same as measured by Alice. With varying the 
squeezing value, either coherent or squeezed state is conditionally prepared in Bob's mode. 
The correspondence between the modified EPR-based scheme and the generalized preparation 
scheme in terms of variances reads 



1 + Va p 

v V ^ V + gg) ™ 
a x {l + Va p ) 

where a x and a p are variances of, respectively, amplitude and phase quadrature 
displacement, and V is squeezed variance in the prepare-and-measure scheme; V\ is squeezed 
and V2 is anti-squeezed variance of the states, used to construct the entangled state, and V m is 
the squeezed variance of the state put to the free port of a heterodyne detector at Alice side in 
the EPR-based scheme. 

The mutual Shannon information between parties is the same for both DR and RR 
scenarios and is calculated using variances and conditional variances of the respective mode 
quadratures as Iab = 1/2 log 2 V b /V b \a = 1/2 log 2 Va/Va\b, where Va = l/4(Vi+V 2 +2V r m ) 
is the variance of Alice's mode, Vb = r)/2(Vi + V 2 + 2e) + 1 — r\ is Bob's mode variance after 
the channel, and V b \a = Vb — C ab /Va, where Cab = y/v(V2 ~ V\)/2\/2 is the correlation 
between Alice and Bob, so that 

(similarly for Va\b)- Without loss of generality, we assume that ^-quadrature is 
squeezed in the prepare-and-measure scenario and is, accodringly, measured by Alice in 
the entanglement-based scheme. In the case, when the squeezing direction is orthogonally 
rotated, the results for the squeezing and measurement of p-quadrature are directly accesible 
by transitions V\ ->■ 1/Vi, V 2 -> 1/V 2 and V m -> 1/V m . 

In terms of the prepare-and-measure generalized scheme, the mutual information 
between the trusted parties reads: 



Iab = \ !og 2 



1 + 



X + r](V + e-V 



(5) 
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where A = 1 corresponds to homodyne detection and A = 2 to heterodyne (note that obtaining 
classical information from the measurements of anti-squeezed quadrature is ineffective, unless 
the state is close to coherent). However, in the following exposition we consider only 
homodyne measurement. The reason for this is that heterodyne, being advantageous under 
RR and disadvantageous under DR, can be regarded as the particular case of "fighting noise 
with noise" [11] when trusted noise at the Bob side decouples Eve from the measurement 
results. This effect is practically independent of squeezing (being valid also for coherent sates 
if bases are switched) and does not change the results below, which reveal the role of limited 
squeezing in CV QKD. 

As was mentioned, Eve's information under the assumption of collective eavesdropping 
strategy is upper limited by the Holevo quantity xae (Xbe upon RR). The Holevo quantity 
can be written as xae = Se ~ f P(A)Se\a(IA, where Se is the von Neumann entropy 
of the eavesdropper state pe lfl9l . The quantity Se\a is the von Neumann entropy of the 
eavesdropper state pe\a conditioned by the reference side measurement result A and P(A) 
is the distribution of the measured results. In case of Gaussian modulation of the coherent 
or squeezed states the entropy Se\a does not depend on Alice's measurement results and the 
Holevo quantity is expressed as xae = Se — Se\a (similarly, xbe = Se — Se\b in the reverse 
reconciliation scenario) OTTl . If channel noise is present, it is assumed that in the worst- 
case scenario the eavesdropper can purify the state shared between the trusted parties, thus 
Se = Sab, where Sab is the entropy of the state between Alice and Bob, and Se\a — Sbc\a, 
and Sbc\a is calculated from the conditional two-mode state (including Alice's heterodyne 
mode C) after Alice's projective measurement. Similar considerations apply for the case 
of RR and give slightly simpler expression Xbe = Sab — Sa\b (since Alice's heterodyne 
measurement does not change the entropies and taking mode C into account is not necessary), 
with the latter term being calculated from the state shared between Alice and Bob conditioned 
on Bob's measurement. 

The covariance matrix jab of the two-mode Alice-Bob state after heterodyne at Alice is 
given by: 

( VI JqC\ B \ 

VI JqC\ B 

^qC\ B v (V§ + e-l) + l 
V v (V£ + e-l) + l J 

where source variances are V% = (V 1 + V 2 +2V m ) /A, V V A = l/(W 1 ) + l/(W 2 ) + l/(2V m ), 
Vg = (Vi + V 2 )/2, VI = 1/(2V 1 ) + 1/(2V 2 ), and source correlations are C\ B = (V 2 - 
V 1 )/(2V2) and C P AB = (1/V 2 - l/V 1 )/{2y/2). 

The conditional matrix ^ X A B after Bob's homodyne measurement in x, which is used in 
the calculation of the RR scenario, is obtained ( |[T9lO as 

1 X A B =1A~ a AB {X lB X) MP a T AB , (7) 



1AB 



(6) 



where ^a ,1b an d &ab are the submatrices of Iab, standing for individual modes and 
their correlation, MP denotes the Moore-Penrose pseudoinverse of a matrix and X is the 
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2x2 matrix, with elements equal to 0, except the first, which is 1. The resulting matrix 7^ s 
is given by 

/ V x _ v(Vi-V2) 2 n \ 

x B _ I v A 8 +4r?(Vi+V2+2e-2) U (Q\ 

lA { o vl )■ w 

The entropies then are given by the expressions Sab = G[(Xi — l)/2]+G[(A2 — 1)/2] and 
Sa\b = G[(\z — l)/2], where Ai^ are the symplectic eigenvalues of the matrix jab, A3 is the 
symplectic eigenvalue of j A B , and G(x) = (x + 1) log(x + 1) — x \ogx. Similar calculations 
apply to the DR scenario, when Sbc\a is calculated from two symplectic eigenvalues of the 
covariance matrix 7^7 after Alice's measurement in x. 

In the simplest case of a purely lossy channel the key rate can be relatively easy 
calculated analytically. Indeed, the channel in this case can be described as a beam splitter 
with transmittance 77. Then the state, which is available to Eve for collective measurement, 
is the state of the second output mode of the beam splitter. The von Neumann entropies, 
contributing to the Holevo quantity, are directly calculated from two symplectic eigenvalues 
Ai 2 of the two 2x2 covariance matrices, describing Eve's mode state p E before and p E \& 
(or p E \ B depending on reconciliation direction) after the respective trusted party measurement 
(calculated similarly to ©), resulting in x = G[(Xi — l)/2] — G[(X 2 — l)/2]. The symplectic 
eigenvalues are then the square roots of covariance matrix determinants, which, since matrices 
are diagonal, are the products of matrix elements, and, in the more relevant case of reverse 
reconciliation, read: 



Ai= n + v (9) 

i={x,p} 

A 2 = ^(l-,) + ,-^s£-)(vS(l -,)+,), (10) 

where C BE = \/rj(l — 77) (1 — V E P ) is the correlation between Bob's and Eve's modes 
in x(p) quadrature (note, that similar calculations apply to the measurement of p quadrature). 
Taking into account the expressions for mode variances, after straightforward calculations 
these symplectic eigenvalues directly give expression for the Holevo quantity, and, being 
combined with mutual information © lead to the analytical expression for the lower bound 
on the key rate (Q~|) under pure channel loss. 

In the presence of channel noise the calculations were performed semianalytically with 
numerical estimations in the general case and analytical expressions in the limiting cases. 
Further we estimate the key rate and establish the security bounds in terms of the tolerable 
channel noise, which is the main objective limitation for security of the protocols, since any 
loss can be tolerated upon the RR. 
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3. Squeezed state quantum key distribution (QKD) with limited reconciliation efficiency 

While in [8im|T0l[IH[l2l[l5l the reconciliation efficiency is perfect, we focus here on limited 
reconciliation efficiency. This must be taken into account, since it turns out to be one of 
the main practical limiting factors for the Gaussian CV QKD, especially if RR is used. In 
particular, the efficiency j3 E (0.8, 0.9) was reached in the recent experimental implementation 
of the Gaussian CV QKD with coherent states and RR lfT9l . and thus the scheme was limited 
by the 25 km distance (corresponding to transmittance i] « 0.3), while displacement had to 
be optimized. 

Although reconciliation efficiency can be relatively high in the case of DR, we start 
from this scenario. First, on figure [2] (left) we show how the secure key rate depends on 
displacement variance for different values of squeezing and reconciliation efficiency. It is 
evident from the plots that even moderate squeezing (— 3dB) quantitatively improves the key 
rate, while displacement variance must be optimized. 




20 40 60 80 100 20 40 60 80 100 



Figure 2. Lower bound on the key rate secure against collective attacks in the DR (left) and RR 
(right) scenarios for coherent state V = 1 (dotted lines), moderately squeezed states V = 0.5 
(dashed lines) and strongly squeezed states V = 0.1 (solid lines). Upper lines correspond to 
reconciliation efficiency (3 — 0.95, lower lines correspond to (3 — 0.9. Channel transmittance 
is r] = 0.6 for DR and i] = 0.1 for RR. 

Similar behaviour is demonstrated by the security region in terms of the tolerable channel 
noise, which also depends on squeezing and displacement (see figure [3]). 

As was already analyzed in |fT2|. upon perfect reconciliation, limited squeezing with 
low modulation (small displacement variance) improves the tolerance of the DR scheme 
to loss, while infinitely strong squeezing is disadvantageous from the point of view of 
tolerable channel noise, compared to the coherent states. In contrast to this, upon imperfect 
reconciliation, squeezing continuously improves the security region of the protocol, while 
displacement must be limited and optimized to provide maximum tolerance to channel noise 
for given signal state variance. Optimization was performed for the case of DR at fixed values 
of (3 with the results given in figure 0] for low channel transmittance. The results evidently 
demonstrate the positive role of finite squeezing for DR upon imperfect reconciliation. 

Moreover, when efficiency (3 is low enough, squeezing appears to be strictly required 
to establish secure quantum communication, as Gaussian modulated coherent states fail to 
provide a positive key rate even upon purely lossy channel. This restriction was analytically 
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Figure 3. Security region for the CV QKD scheme upon DR versus squeezed variance V 
and displacement variance a for channel transmittance r\ = 0.6 and reconciliation efficiency 
^ = 0.9, 0.8, 0.7, 0.6 (from left to right, from top to bottom). 




Figure 4. Maximum tolerable channel excess noise versus squeezing V upon optimized 
displacement variance a, applied to both quadratures. Left: DR, reconciliation efficiency 
/? = 0.9, 0.85, 0.8, 0.7, 0.6 (from top to bottom), channel transmittance rj = 0.6; right: RR, 
reconciliation efficiency /3 = 0.8,0.6,0.4,0.2 (from top to bottom), channel transmittance 
7] = 0.1. 

obtained already for the case of individual attacks on coherent states-based protocol when 
security can be provided only for reconciliation efficiency within the security constraint 
(3 > I/77 — 1, 77 G (0.5, 1) (for optimized displacement, giving the highest key rate). For 
the case of collective attacks, the maximum variance of the signal states, providing positive 
key rate, upon optimized displacement, was calculated numerically and is given in figure [5] 
It is clearly seen, that squeezing of the states becomes required upon reduced reconciliation 
efficiency and low channel transmittance, and the necessity in squeezing is enforced by a 



Squeezed-state quantum key distribution upon imperfect reconciliation 



9 



1.0 
0.8 
0.6 
0.4 

0.2 



0.2 0.4 0.6 0.8 1.0 

Figure 5. Maximum squeezed variance of the signal states, providing a positive key rate, upon 
direct reconciliation and optimized displacement, for the given reconciliation efficiency f3 and 
different values of channel transmittance rj = 0.99, 0.9, 0.8, 0.7, 0.6, 0.51 (from left to right). 

decrease of both of the parameters. Thus, in the respective region of parameters, Gaussian 
DR CV QKD protocol enters strictly the nonclassical regime when only squeezed states can 
provide security of the key, even under pure channel loss. 

However, since the DR scenario is more effective in terms of reconciliation and it 
cannot tolerate transmittances lower than 0.5, it is more important to analyze how limited 
reconciliation affects the RR scheme. Indeed, the RR protocols, already being less effective 
in data processing, are aimed to perform upon highly lossy long-distance channels, while 
losses additionally decrease signal-to-noise ratio (SNR) and, accordingly, (3. The explicit 
dependence of (3 on SNR is the intrinsic feature of a particular scheme, as it also depends on 
the effectiveness of classical algorithms used for Gaussian data binarization and subsequent 
error correction. The practical reconciliation codes are known to provide less than 50% 
efficiency for SNR around 1 11321 . However, in practice (from the implementation of a 
coherent protocol |[T9~l0 it is known that the key rate is the convex function of SNR for 
< 1 and the lower the reconciliation efficiency, the lower the optimal displacement variance. 
Moreover, for reduced efficiency the displacement must be limited. For f3 = 0.7, for example, 
the maximum applicable displacement variance for coherent states is approximately 4 SNU, 
which, in turn, makes SNR about 0.4 after the channel with 10% transmittance, and this 
additionally lowers the achievable reconciliation efficiency below 50%. Thus, it is generally 
reasonable to consider low values of (3 in order to clarify the role of the resources in the 
applicability of Gaussian QKD under RR scenario. 

The results of the numerical estimation of the key rate for the reduced reconciliation 
efficiency of the reverse protocol under purely lossy channel with transmittance 77 = 0.1 are 
given in figure |2] (right). Similarly to the case of DR, squeezing quantitatively improves the 
key rate already for the pure channel loss, and under reduced efficiency displacement variance 
must be optimized to provide maximum key rate. In case when displacement is optimized, 
even moderate squeezing is shown to improve the key rate values and the maximum distance 
of the Gaussian protocol upon the given fixed channel noise e, as seen from figure |6] (left). 

The security region of the RR Gaussian protocol in terms of the maximum tolerable 
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Figure 6. Left: lower bound on the key rate secure against collective attacks in the RR 
scenario versus distance (in fiber with standard attenuation of -0.2 dB/km) for coherent V = 1 
(dotted lines), moderately squeezed V = 0.5 (dashed lines) and strongly squeezed V = 0.1 
(solid lines) signal states upon optimized displacement variance. Upper lines correspond to 
reconciliation efficiency (3 = 0.95 and lower lines correspond to f3 = 0.9. Channel noise is 
fixed at e = 0.1. Right: profile of the Holevo quantity, upper limiting the information, available 
to Eve in the RR scheme versus state squeezing V and applied displacement variance a for 
low channel transmittance r\ = 0.1 and no channel noise. 



channel noise demonstrates the analogous behaviour as seen from figure [7J under reduced 
efficiency the security region is shrinking and displacement variance must be reduced as well 
(which is already known for a coherent protocol [19]). Note, that "traditional" squeezed-based 
schemes [|8l HI [lOl HH H2l with displacement variance o = l/V — V start to be inapplicable 
under limited 0. However, it turns out that squeezed states allow higher displacement variance 
and provide higher tolerable excess noise. This is clearly visible from the profiles of the 
maximum tolerable channel excess noise under optimized displacement variance, given in 
figure 0] (right), for various values of (3. While for relatively high (3 = 0.8 and even (3 = 0.6 
coherent states (V = 1) still show a reasonable offset in terms of the tolerable channel noise, 
for lower reconciliation efficiency it is negligibly small, at the same time even moderate 
squeezing provides tolerance to noise. Remarkably, the dependence on squeezing remains 
close to linear, i.e. squeezing is linearly improving maximum tolerable channel noise in the 
whole region of reconciliation efficiency. At the same time, under low efficiencies Gaussian 
modulated coherent states fail to demonstrate any noticeable tolerance to noise. 

In the limiting case of highly squeezed states V — > the displacement variance must be 
in the range: 

1 , 1 

<°\ V ^<~ 75? (ID 



1 + '™ 

The typical values of maximum tolerable channel excess noise e upon fixed limited 
reconciliation efficiency (3 and optimal displacement variance a for coherent states V = 1 and 
moderately squeezed states V = 0.5 (i.e., -3 dB of squeezing, which is completely feasible 
with current technology, as -10 dB was already obtained 113310 are given in the table [Q It is 
evident from the table that at low reconciliation efficiency the limited squeezing can already 
achieve tolerance to the channel noise, which is about an order of magnitude higher than is 
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Table 1. Values of the maximum tolerable channel excess noise e upon limited reconciliation 
efficiency and optimal displacement variance a for coherent states V = 1 and moderately 
squeezed states V — 0.5, channel transmittance is r\ = 0.1 

Maximum tolerable e 

P V=l V = 0.5 

20% 10~ 3 1.3 • 10" 2 

40% 3.7 -10- 3 3.4 -10- 2 

60% 1.2 -10- 2 6.3 -10- 2 

80% 3.8 -10- 2 1.1 -10" 1 



tolerable by coherent states upon the same efficiency (3 and the same channel transmittance. 

Thus, in the region of low efficiency (3 and in the presence of evident untrusted noise, the 
Gaussian CV QKD protocol enters the nonclassical regime when at least moderate squeezing 
is required to enable secure key distribution. 




Figure 7. Security region for the CV QKD scheme upon RR versus squeezed variance V 
and displacement variance a for channel transmittance r\ = 0.1 and reconciliation efficiency 
/3 = 0.8, 0.6, 0.4, 0.2 (from left to right, from top to bottom). 

The reason for this effect is in the behavior of the Holevo quantity xeb, describing the 
upper bound on the quantum information, available to an eavesdropper. Indeed, for low (3 
the contribution of mutual information to the lower bound (QQ) becomes very low; in addition, 
for low channel transmittances 77 <gC 1 the mutual information practically does not depend on 
squeezing as Iab = <Jr]/\ogA + 0[r^] 2 . Thus, the question is: which kind of states is more 
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effectively minimizing the Holevo quantity? Although the Holevo quantity is the entropic 
measure of maximum information, available to an eavesdropper, its minimization has direct 
physicsl meaning. 

For the purely lossy channels the Holevo quantity is minimized with the value 0, which 
is reached when the two parts of the quantity xbe = Se — Se\b (calculated from Eve's 
state and Eve's state conditioned by Bob's measurement) are equal. From expressions © 
and ([TO]) for symplectic eigenvalues, which are used to calculate both parts Se and S e \b of 
the Holevo quantity, it is evident that the eigenvalues (and, accordingly, the two parts of the 
Holevo quantity) are equal when correlation between Bob and Eve is equal to 0. It is achieved, 
regardless of channel transmittance, when V§ = 1, i.e. a x = 1 — V, where V is the squeezed 
state variance in the prepare-and-measure scheme. The typical profile of xeb is given at figure 
[6] (right) versus signal state squeezing and displacement variance upon purely lossy channel. 

In case when channel noise is present, the Holevo quantity is minimized upon the same 
value of modulation (the minimum value being positive, i.e. the typical plot of the Holevo 
quantity, given in figure [6[ is moved up by the channel noise equivalently for any squeezing 
and modulation). It was confirmed numerically using the purification method, but can also 
be obtained from analytical considerations if entangling doner attack is considered. Such an 
attack was shown to be the optimal individual attack [|30ll and was recently used to calculate 
security against collective attacks [34J. Under entangling doner attack the correlation 
between Bob and Eve's doner mode is again directly accessible, it is \/r/(l — rj)(l — V§+rje), 
where e is the channel noise. Again, this correlation is minimized upon V§ being equal to 1. 

Thus, the minimum of the Holevo quantity, i.e. the minimization of the upper bound on 
information, available to Eve, which is relevant in the low j3 regime upon RR, is achieved upon 
complete (for pure channel loss) or maximum possible decoupling of Eve from Bob, when the 
correlation between their modes is minimized. It depends solely on the state properties before 
channel and is described by the simple condition a x = 1 — V. Evidently, squeezed states 
reach this de-correlation upon positive displacement variance, while coherent states minimize 
the Holevo quantity only when no displacement is applied. Moreover, in case when the 
reconciliation efficiency is arbitrarily small (i.e. ^ < 1) the security can be achieved only for 
a < 1 — V, which is evidently for Gaussian modulated coherent states, i.e. no information 
can be added to coherent states by displacement, when reconciliation efficiency (3 is low. At 
the same time even small squeezing of quantum states allows additional displacement and is 
thus able to carry information, contributing to the secure key. 

Thereby, the case of low reconciliation efficiency represents the essentially nonclassical 
region of QKD, where squeezing plays the main role, whereas the contribution from the 
classical resources is minor. From this follows that nonclassical resource, namely squeezing, 
can partly substitute the limited classical reconciliation resource. 

4. Conclusions 

We have analyzed the role of squeezing in the continuous-variable quantum key distribution, 
clearly distinguishing squeezing from displacement in a generalized preparation scheme, 
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taking into account imperfect reconciliation. We have shown that squeezing improves 
tolerance to untrusted noise in both direct and reverse reconciliation schemes and is strictly 
required in the direct case when reconciliation efficiency is low. For highly attenuating 
channels, corresponding to long-distance links, squeezing demonstrates linear improvement 
of the security region in terms of tolerable untrusted noise under optimized displacement. 
Hereby, even limitedly squeezed states can provide security in the conditions of a strongly 
attenuating channel and in the presence of untrusted noise, contrary to coherent states, which 
fail to demonstrate any non-negligible tolerance to noise under the same low reconciliation 
efficiency. The reason for the effect is the behavior of the Holevo quantity, upper bounding 
the eavesdropper's information. It turns out to be more effectively minimized by the squeezed 
states, i.e. under higher displacement, applied to the states. 

Thus, under low reconciliation efficiency, both direct and reverse Gaussian protocols 
enter essentially the nonclassical regime, when tolerance to the noticeable channel noise can 
be provided only by squeezed states. Weak Gaussian modulation of moderately squeezed 
states in the reverse scenario can be a feasible alternative to the discrete modulation of 
coherent states for the long-distance links. However, the most effective solution will probably 
be the combination of the two approaches with optimization of both modulation scheme and 
quantum state as the resource. 
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